Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
binadd_dynsym = binadd.dynamic_symbols
# Change add in the libary
for sym in libadd_dynsym:
if sym.name == "add":
sym.name = "abc"
# Change "add" in the binary
for sym in binadd_dynsym:
if sym.name == "add":
sym.name = "abc"
# change library name in the binary
for entry in binadd.dynamic_entries:
if entry.tag == lief.ELF.DYNAMIC_TAGS.NEEDED and entry.name == "libadd.so":
entry.name = "libabc.so"
libadd_modified = os.path.join(self.tmp_dir, "libabc.so")
binadd_modified = os.path.join(self.tmp_dir, "binadd_obf.bin")
libadd.write(libadd_modified);
binadd.write(binadd_modified)
st = os.stat(libadd_modified)
os.chmod(libadd_modified, st.st_mode | stat.S_IEXEC)
st = os.stat(binadd_modified)
os.chmod(binadd_modified, st.st_mode | stat.S_IEXEC)
p = Popen([binadd_modified, '1', '2'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, env={"LD_LIBRARY_PATH": self.tmp_dir})
stdout, _ = p.communicate()
def test_remove_tag(self):
sample = LibAddSample()
libadd = lief.parse(sample.libadd)
binadd = lief.parse(sample.binadd)
self.logger.debug("BEFORE")
list(map(lambda e : self.logger.debug(e), binadd.dynamic_entries))
self.logger.debug("")
binadd -= lief.ELF.DYNAMIC_TAGS.NEEDED
self.logger.debug("AFTER")
list(map(lambda e : self.logger.debug(e), binadd.dynamic_entries))
self.logger.debug("")
self.assertTrue(all(e.tag != lief.ELF.DYNAMIC_TAGS.NEEDED for e in binadd.dynamic_entries))
self.logger.debug("libc used: {}".format(libc_name))
libc = lief.parse('/usr/lib/{}'.format(libc_name))
out = os.path.join(tmp_dir, libc_name)
for i in range(10):
segment = stub.segments[0]
original_va = segment.virtual_address
segment.virtual_address = 0
segment = libc.add(segment)
new_ep = (stub.header.entrypoint - original_va) + segment.virtual_address
if libc.has(lief.ELF.DYNAMIC_TAGS.INIT_ARRAY):
init_array = libc.get(lief.ELF.DYNAMIC_TAGS.INIT_ARRAY)
callbacks = init_array.array
callbacks[0] = new_ep
init_array.array = callbacks
if libc.has(lief.ELF.DYNAMIC_TAGS.INIT):
init = libc.get(lief.ELF.DYNAMIC_TAGS.INIT)
init.value = new_ep
libc.write(out)
st = os.stat(out)
os.chmod(out, st.st_mode | stat.S_IEXEC)
p = Popen(["/usr/bin/ls"], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, env={"LD_LIBRARY_PATH": tmp_dir})
stdout, _ = p.communicate()
if len(dynamic_entries) == 0:
return
print("== Dynamic entries ==\n")
f_title = "|{:<16} | {:<10}| {:<20}|"
f_value = "|{:<16} | 0x{:<8x}| {:<20}|"
print(f_title.format("Tag", "Value", "Info"))
for entry in dynamic_entries:
if entry.tag == ELF.DYNAMIC_TAGS.NULL:
continue
if entry.tag in [ELF.DYNAMIC_TAGS.SONAME, ELF.DYNAMIC_TAGS.NEEDED, ELF.DYNAMIC_TAGS.RUNPATH, ELF.DYNAMIC_TAGS.RPATH]:
print(f_value.format(str(entry.tag).split(".")[-1], entry.value, entry.name))
elif type(entry) is ELF.DynamicEntryArray: # [ELF.DYNAMIC_TAGS.INIT_ARRAY,ELF.DYNAMIC_TAGS.FINI_ARRAY]:
print(f_value.format(str(entry.tag).split(".")[-1], entry.value, ", ".join(map(hex, entry.array))))
elif entry.tag == ELF.DYNAMIC_TAGS.FLAGS:
flags_str = " - ".join([str(ELF.DYNAMIC_FLAGS(s)).split(".")[-1] for s in entry.flags])
print(f_value.format(str(entry.tag).split(".")[-1], entry.value, flags_str))
elif entry.tag == ELF.DYNAMIC_TAGS.FLAGS_1:
flags_str = " - ".join([str(ELF.DYNAMIC_FLAGS_1(s)).split(".")[-1] for s in entry.flags])
print(f_value.format(str(entry.tag).split(".")[-1], entry.value, flags_str))
else:
print(f_value.format(str(entry.tag).split(".")[-1], entry.value, ""))
print("")
print("== Dynamic entries ==\n")
f_title = "|{:<16} | {:<10}| {:<20}|"
f_value = "|{:<16} | 0x{:<8x}| {:<20}|"
print(f_title.format("Tag", "Value", "Info"))
for entry in dynamic_entries:
if entry.tag == ELF.DYNAMIC_TAGS.NULL:
continue
if entry.tag in [ELF.DYNAMIC_TAGS.SONAME, ELF.DYNAMIC_TAGS.NEEDED, ELF.DYNAMIC_TAGS.RUNPATH, ELF.DYNAMIC_TAGS.RPATH]:
print(f_value.format(str(entry.tag).split(".")[-1], entry.value, entry.name))
elif type(entry) is ELF.DynamicEntryArray: # [ELF.DYNAMIC_TAGS.INIT_ARRAY,ELF.DYNAMIC_TAGS.FINI_ARRAY]:
print(f_value.format(str(entry.tag).split(".")[-1], entry.value, ", ".join(map(hex, entry.array))))
elif entry.tag == ELF.DYNAMIC_TAGS.FLAGS:
flags_str = " - ".join([str(ELF.DYNAMIC_FLAGS(s)).split(".")[-1] for s in entry.flags])
print(f_value.format(str(entry.tag).split(".")[-1], entry.value, flags_str))
elif entry.tag == ELF.DYNAMIC_TAGS.FLAGS_1:
flags_str = " - ".join([str(ELF.DYNAMIC_FLAGS_1(s)).split(".")[-1] for s in entry.flags])
print(f_value.format(str(entry.tag).split(".")[-1], entry.value, flags_str))
else:
print(f_value.format(str(entry.tag).split(".")[-1], entry.value, ""))
print("")
def print_dynamic_entries(binary):
dynamic_entries = binary.dynamic_entries
# Dynamic entries
if len(dynamic_entries) == 0:
return
print("== Dynamic entries ==\n")
f_title = "|{:<16} | {:<10}| {:<20}|"
f_value = "|{:<16} | 0x{:<8x}| {:<20}|"
print(f_title.format("Tag", "Value", "Info"))
for entry in dynamic_entries:
if entry.tag == ELF.DYNAMIC_TAGS.NULL:
continue
if entry.tag in [ELF.DYNAMIC_TAGS.SONAME, ELF.DYNAMIC_TAGS.NEEDED, ELF.DYNAMIC_TAGS.RUNPATH, ELF.DYNAMIC_TAGS.RPATH]:
print(f_value.format(str(entry.tag).split(".")[-1], entry.value, entry.name))
elif type(entry) is ELF.DynamicEntryArray: # [ELF.DYNAMIC_TAGS.INIT_ARRAY,ELF.DYNAMIC_TAGS.FINI_ARRAY]:
print(f_value.format(str(entry.tag).split(".")[-1], entry.value, ", ".join(map(hex, entry.array))))
elif entry.tag == ELF.DYNAMIC_TAGS.FLAGS:
flags_str = " - ".join([str(ELF.DYNAMIC_FLAGS(s)).split(".")[-1] for s in entry.flags])
print(f_value.format(str(entry.tag).split(".")[-1], entry.value, flags_str))
elif entry.tag == ELF.DYNAMIC_TAGS.FLAGS_1:
flags_str = " - ".join([str(ELF.DYNAMIC_FLAGS_1(s)).split(".")[-1] for s in entry.flags])
print(f_value.format(str(entry.tag).split(".")[-1], entry.value, flags_str))
else:
print(f_value.format(str(entry.tag).split(".")[-1], entry.value, ""))
print("")
def create_section_dynstr(elf):
section = Section()
section.name = ".dynstr"
section.type = lief.ELF.SECTION_TYPES.STRTAB
section.flags = lief.ELF.SECTION_FLAGS.ALLOC
section.link = 0
section.information = 0
section.alignment = 1
section.offset = 0
section.entry_size = 0
section.size = 0
for de in elf.dynamic_entries:
if de.tag == lief.ELF.DYNAMIC_TAGS.STRTAB:
section.virtual_address = de.value
section.offset = elf.virtual_address_to_offset(de.value)
if de.tag == lief.ELF.DYNAMIC_TAGS.STRSZ:
section.size = de.value
if not section.offset and not section.size:
raise Exception("No dynamic entries for strings")
return section
def get_uniqueness_key(file):
binary = ensure_binary(file)
if binary.format == lief.EXE_FORMATS.MACHO:
return binary.name
elif (binary.format == lief.EXE_FORMATS.ELF
and # noqa
(binary.type == lief.ELF.ELF_CLASS.CLASS32 or binary.type == lief.ELF.ELF_CLASS.CLASS64)):
dynamic_entries = binary.dynamic_entries
result = [e.name for e in dynamic_entries if e.tag == lief.ELF.DYNAMIC_TAGS.SONAME]
if result:
return result[0]
return binary.name
return binary.name
# XXXXXXXXXXXXXXXXXXXXX
# You got it !!
import lief
crackme = lief.parse("crackme.bin")
hook = lief.parse("hook")
segment_added = crackme.add(hook.segments[0])
my_memcmp = hook.get_symbol("my_memcmp")
my_memcmp_addr = segment_added.virtual_address + my_memcmp.value
crackme.patch_pltgot('memcmp', my_memcmp_addr)
# Remove bind now if present
if lief.ELF.DYNAMIC_TAGS.FLAGS in crackme:
flags = crackme[lief.ELF.DYNAMIC_TAGS.FLAGS]
flags.remove(lief.ELF.DYNAMIC_FLAGS.BIND_NOW)
if lief.ELF.DYNAMIC_TAGS.FLAGS_1 in crackme:
flags = crackme[lief.ELF.DYNAMIC_TAGS.FLAGS_1]
flags.remove(lief.ELF.DYNAMIC_FLAGS_1.NOW)
# Remove RELRO
if lief.ELF.SEGMENT_TYPES.GNU_RELRO in crackme:
crackme[lief.ELF.SEGMENT_TYPES.GNU_RELRO].type = lief.ELF.SEGMENT_TYPES.NULL
crackme.write("crackme.hooked")
def _set_elf_rpathy_thing(binary, old_matching, new_rpath, set_rpath, set_runpath):
dynamic_entries = binary.dynamic_entries
changed = False
for e in dynamic_entries:
if (set_runpath and
e.tag == lief.ELF.DYNAMIC_TAGS.RUNPATH and
glob2.fnmatch.fnmatch(e.runpath, old_matching) and
e.runpath != new_rpath):
e.runpath = new_rpath
changed = True
elif (set_rpath and
e.tag == lief.ELF.DYNAMIC_TAGS.RPATH and
glob2.fnmatch.fnmatch(e.rpath, old_matching) and
e.rpath != new_rpath):
e.rpath = new_rpath
changed = True
return changed